CVE-2025-54752

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

Multiple versions of PowerCMS improperly neutralize formula elements in a CSV file. If a product user creates a malformed entry and a victim user downloads it as a CSV file and opens it in the user's environment, the embedded code may be executed.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1236

Affected software

Vendor	Product	Versions
Alfasado Inc.	PowerCMS	6.7 and earlier (PowerCMS 6.x series)
Alfasado Inc.	PowerCMS	5.3 and earlier (PowerCMS 5.x series)
Alfasado Inc.	PowerCMS	4.6 and earlier (PowerCMS 4.x series)

References

https://jvn.jp/en/vu/JVNVU93412964/Third Party Advisory
https://www.powercms.jp/news/release-powercms-671-531-461.htmlThird Party Advisory

Timeline

Published: Jul 31, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-547548.0An attacker with adjacent access, without authentication, can exploit this vulnerability to retrieve a hard-coded password embedded in pub CVE-2025-547554.9A directory traversal vulnerability exists in TMUI that allows a highly privileged authenticated attacker to access files which are not limi CVE-2025-547568.4BrightSign players running BrightSign OS series 4 prior to v8.5.53.1 or series 5 prior to v9.0.166 use a default password that is guessable CVE-2025-547578.0Multiple versions of PowerCMS allow unrestricted upload of dangerous files. If a product administrator accesses a malicious file uploaded by CVE-2025-547596.1Sante PACS Server is vulnerable to stored cross-site scripting. An attacker could inject malicious HTML codes redirecting a user to a malici CVE-2025-54768.8Sony XAV-AX8500 Bluetooth Improper Isolation Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to by CVE-2025-547604.8Stored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier allow execution of arbitrary JavaScript in a user’s we CVE-2025-547618.0An issue was discovered in PPress 0.0.9 allowing attackers to gain escilated privlidges via crafted session cookie.CVE-2025-547629.3SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenticated attacker to upload arbitrary files and exe CVE-2025-547637.2FutureNet MA and IP-K series provided by Century Systems Co., Ltd. contain an OS command Injection vulnerability. A user who logs in to the CVE-2025-547646.2Mbed TLS before 3.6.5 allows a local timing attack against certain RSA operations, and direct calls to mbedtls_mpi_mod_inv or mbedtls_mpi_gc CVE-2025-547655.3An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web applic